CVE-2024-51558: 63moons Aero Auth Bypass Vulnerability

CVE-2024-51558 Overview

CVE-2024-51558 is a critical authentication vulnerability affecting 63moons Wave 2.0 and Aero applications. The vulnerability exists due to missing restrictions for excessive failed authentication attempts on the API-based login mechanism. A remote attacker could exploit this vulnerability by conducting a brute force attack against legitimate user credentials including OTP, MPIN, or password, potentially leading to unauthorized access and compromise of user accounts.

Critical Impact

Remote attackers can bypass authentication controls through unrestricted brute force attacks, enabling complete account takeover and unauthorized access to sensitive user data and financial transactions.

Affected Products

• 63moons Wave 2.0 (all versions)
• 63moons Aero (all versions)

Discovery Timeline

• 2024-11-04 - CVE-2024-51558 published to NVD
• 2024-11-08 - Last updated in NVD database

Technical Details for CVE-2024-51558

Vulnerability Analysis

This vulnerability is classified under CWE-307 (Improper Restriction of Excessive Authentication Attempts). The Wave 2.0 application's API-based login endpoint fails to implement proper rate limiting or account lockout mechanisms, leaving authentication endpoints exposed to automated credential attacks.

The vulnerability allows network-based attacks without requiring any prior authentication or user interaction. Successful exploitation could result in complete compromise of user accounts, exposing confidential data, enabling unauthorized transactions, and potentially providing attackers with a foothold for further attacks against other user accounts within the system.

Root Cause

The root cause of this vulnerability is the absence of protective mechanisms to restrict repeated authentication attempts. The API login endpoint lacks:

• Rate limiting controls to throttle authentication requests
• Account lockout policies after a threshold of failed attempts
• CAPTCHA or similar bot-detection mechanisms
• Progressive delays between authentication attempts

Without these safeguards, attackers can submit unlimited authentication requests at high speed, making brute force attacks against OTP codes, MPINs, and passwords computationally feasible.

Attack Vector

The attack vector is network-based, allowing remote exploitation without authentication. An attacker can target the API login endpoint and systematically attempt credential combinations:

1. The attacker identifies the authentication API endpoint for Wave 2.0 or Aero applications
2. Using automated tools, the attacker sends rapid authentication requests with different OTP, MPIN, or password values
3. Due to the lack of rate limiting, thousands of attempts can be made in seconds
4. Once valid credentials are discovered, the attacker gains unauthorized access to the victim's account

Given the limited keyspace of OTP and MPIN values (typically 4-6 digits), brute force attacks can succeed within minutes without proper rate limiting controls. For additional technical details, refer to the CERT-In Security Advisory CIVN-2024-0332.

Detection Methods for CVE-2024-51558

Indicators of Compromise

• High volume of failed authentication attempts from single IP addresses or IP ranges targeting the API login endpoint
• Unusual patterns in authentication logs showing sequential or systematic credential attempts
• Successful login following a large number of failed attempts from the same source
• Authentication requests originating from known malicious IP addresses or hosting providers commonly used for automated attacks

Detection Strategies

• Implement monitoring rules to alert on authentication failure rates exceeding normal thresholds (e.g., more than 10 failures per minute from a single IP)
• Deploy web application firewalls (WAF) with brute force detection capabilities
• Enable logging of all authentication attempts including source IP, timestamp, and credential type (OTP/MPIN/password)
• Correlate authentication logs with threat intelligence feeds to identify known attack sources

Monitoring Recommendations

• Configure SIEM rules to detect and alert on brute force patterns targeting authentication endpoints
• Monitor for unusual geographic patterns in login attempts that may indicate credential stuffing campaigns
• Track successful authentications that follow abnormal failure patterns as potential indicators of successful account compromise
• Establish baselines for normal authentication traffic and alert on significant deviations

How to Mitigate CVE-2024-51558

Immediate Actions Required

• Implement rate limiting on all authentication API endpoints to restrict the number of attempts per IP address and user account
• Deploy account lockout mechanisms that temporarily disable accounts after a configurable number of failed authentication attempts
• Add CAPTCHA challenges after a threshold of failed login attempts to prevent automated attacks
• Consider implementing multi-factor authentication with time-limited tokens and secure delivery channels

Patch Information

Organizations using 63moons Wave 2.0 and Aero applications should contact the vendor directly for security patches and updated versions that address this vulnerability. Refer to the CERT-In Security Advisory CIVN-2024-0332 for official guidance and any available remediation information from the vendor.

Workarounds

• Deploy a web application firewall (WAF) with brute force protection rules in front of authentication endpoints as an interim mitigation
• Implement IP-based rate limiting at the network level using firewall or load balancer configurations
• Enable geographic restrictions to block authentication attempts from regions where legitimate users do not operate
• Consider implementing additional out-of-band verification for sensitive operations until patches are applied

# Example: Rate limiting configuration for nginx (interim mitigation)
# Add to nginx configuration for authentication endpoints
limit_req_zone $binary_remote_addr zone=auth_limit:10m rate=5r/m;

location /api/login {
    limit_req zone=auth_limit burst=3 nodelay;
    limit_req_status 429;
    # Additional proxy or application configuration
}